You could tag your hostnames with the OS, and split your query by that tag. Alternatively, you can do the same with a lookup.
Yes you r right. I am assuming licensing usage by operating system, split down by hostnames which has the os installed.
Try the metrics.log. During each metrics dump (every 30 seconds), the "top X biggest Y" are written out. Where X is defaulted to ten (10), and Y is sourcetype, host, index, etc. The search string would read like:
index=_internal source=*metrics.log group=tcpin_connections | stats sum(kb) AS kb by os
You could also use the results from the os field in the tcpin_connections, to evaluate the OS while getting the accurate license usage from license_usage.log.
could you break down the search to specify heavy hitters by host build using a particular o/s (eg windows)